name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  secrets:
    name: Secret scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      # This repository's predecessor committed a VPN backup and a plaintext
      # database password. This job exists so that cannot happen again.
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  python:
    name: Python
    runs-on: ubuntu-latest
    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_USER: plenum
          POSTGRES_PASSWORD: plenum
          POSTGRES_DB: plenum
        ports: ["5432:5432"]
        options: >-
          --health-cmd pg_isready --health-interval 10s
          --health-timeout 5s --health-retries 5
    env:
      PG_HOST: localhost
      PG_USER: plenum
      PG_PASSWORD: plenum
      PG_DB: plenum
      LLM_DIRECT_URL: http://localhost:9/v1   # never called; tests must not need a model
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip

      - run: pip install -e ".[dev]"

      - name: Lint
        run: ruff check .

      # Proves the schema file is complete and self-consistent. It drifted badly
      # from production once; this stops that recurring silently.
      - name: Apply schema to a clean database
        run: |
          psql -h localhost -U plenum -d plenum -v ON_ERROR_STOP=1 \
            -c "ALTER DATABASE plenum SET app.fts_config = 'swedish';"
          psql -h localhost -U plenum -d plenum -v ON_ERROR_STOP=1 -f _postgres/schema.sql
        env:
          PGPASSWORD: plenum

      - name: Tests
        run: pytest -q

  frontend:
    name: Frontend
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - run: npm ci
      # Not blocking yet: there are pre-existing type errors inherited from the
      # predecessor repository. Remove `continue-on-error` once they are fixed.
      - run: npx tsc --noEmit
        continue-on-error: true
      - run: npm run build